@xenos1996/usa 2.27.0 → 2.28.1

package/dist/scanner/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/scanner/sarif.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,QAAQ,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAUD,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAA6B;IAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE;QACZ,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,GAAY,EAAE,QAAgB,EAAE,OAA6B;IAChF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACnC,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAc,IAAI,GAAG,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;gBACZ,wEAAwE;gBACxE,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAe,EACf,GAMC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACjE,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,MAAM;SACnB;QACD,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,MAAM,KAAK,OAAO,EAAE;QACzD,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG;QACrC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,YAAY,EAAE;YACZ,QAAQ,EAAE,QAAQ,QAAQ,aAAa,KAAK,GAAG;YAC/C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC/B;QACD,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACrB,IAAI,CAAC,GAAG,CAAC;aACT,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC1D,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IAC5D,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;QAC/D,UAAU,EAAE,WAAW,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,kBAAkB,EAAE,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC"}

package/dist/scanner/types.d.ts

@@ -0,0 +1,242 @@
+/**
+ * Scanner subsystem types.
+ *
+ * These are the only types the adapter layer owns, and nothing in `src/engine/`
+ * imports them: a rule consumes scanner *artifacts* through the existing
+ * `oracle` check (ADR-0011) instead of importing evidence objects. That keeps
+ * the dependency direction one-way and keeps the rule engine free of any
+ * scanner-specific schema.
+ */
+/** The tool's own severity word, quoted verbatim and never re-mapped. */
+export type ScannerSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+/**
+ * A scanner's verdict about its own observation — NOT a rule status.
+ * `UNAVAILABLE` exists so that "no evidence found" can never be read as
+ * "the feature does not exist" (Phase 5's hard requirement).
+ */
+export type ScannerVerdict = 'PASS' | 'FAIL' | 'PARTIAL' | 'UNKNOWN' | 'NOT_APPLICABLE' | 'UNAVAILABLE';
+export type ScannerStatus = 'ok' | 'unavailable' | 'timeout' | 'error' | 'skipped';
+/**
+ * One fact, observed by a tool, with enough provenance to re-find it.
+ *
+ * The `id` is a content hash over source + identifier + location + claim, so the
+ * same observation deduplicates across tools and across runs.
+ */
+export interface Evidence {
+    /** Stable content hash (EVT-<hex>). */
+    id: string;
+    source: EvidenceSource;
+    provenance: EvidenceProvenance;
+    claim: string;
+    severity: ScannerSeverity;
+    severitySource: 'tool-native' | 'adapter-default';
+    confidence: number;
+    status: ScannerVerdict;
+    /** Where to look. `null` means the tool does not locate — never "everywhere". */
+    location: EvidenceLocation | null;
+    /** Pointer back into the raw tool output, for re-reading. */
+    rawReference: RawReference;
+    /**
+     * CWE ids the tool itself attached to this finding (`CWE-79`).
+     *
+     * Structured rather than inferred from the claim text, because this is the
+     * join key between scanner evidence and a declared threat model — and a join
+     * built on substring matching would invent relationships.
+     */
+    cwes?: string[];
+}
+export interface EvidenceSource {
+    /** Adapter id, e.g. `trivy`. */
+    tool: string;
+    /** Tool version, as reported by `tool --version`. */
+    version: string;
+    /** Tool-native category (e.g. `vulnerability`, `secret`, `dependency-edge`). */
+    kind: string;
+    /** Tool-native identifier, preserved verbatim (CVE id, rule id, …). */
+    identifier: string;
+}
+export interface EvidenceProvenance {
+    executionId: string;
+    /** argv actually executed, for a re-run. */
+    command: string[];
+    /**
+     * Upstream stages that ran before `command`, in order. Present so that a
+     * provenance record reproduces the run rather than only its last step.
+     */
+    preparedBy?: string[][];
+    /** Adapter config in effect, including rule-pack versions. */
+    config: Record<string, unknown>;
+    /** The commit the target pointed at, or `unversioned`. */
+    repositoryRevision: string;
+    timestamp: string;
+    executable: string;
+    /** Command timeout in milliseconds. */
+    timeoutMs: number;
+    /** Seconds the tool ran. */
+    elapsedMs: number;
+}
+export interface EvidenceLocation {
+    file: string;
+    line?: number;
+    column?: number;
+}
+export interface RawReference {
+    /** Byte offset into the artifact the claim came from. */
+    artifactOffset?: number;
+    jsonPath?: string;
+    excerpt?: string;
+}
+/** A finding produced directly from scanner evidence (path 2). */
+export interface ScannerFinding {
+    id: string;
+    ruleId: string;
+    title: string;
+    claim: string;
+    severity: ScannerSeverity;
+    confidence: number;
+    status: ScannerVerdict;
+    evidenceIds: string[];
+    remediation: string;
+    locations: EvidenceLocation[];
+}
+/** One adapter's record in the run manifest — coverage as a first-class fact. */
+export interface AdapterRun {
+    id: string;
+    available: boolean;
+    version: string;
+    command: string[];
+    /** Upstream stages that ran before `command`, in order. */
+    prepare?: string[][];
+    /** Artifact the evidence was parsed from, relative to the workdir. */
+    artifact?: string;
+    status: ScannerStatus;
+    /** Why an adapter did not produce evidence. Mandatory unless ok. */
+    reason?: string;
+    /**
+     * The process exit status, recorded and never interpreted.
+     *
+     * Tools disagree about what a non-zero status means: ORT exits 2 when it
+     * found violations (the run succeeded), while a usage error is also non-zero.
+     * The verdict comes from the parsed payload; the status is here so a reader
+     * can tell "it ran and objected" from "it never started".
+     */
+    exitCode?: number;
+    evidenceCount: number;
+    elapsedMs: number;
+    needsNetwork: boolean;
+}
+export interface RunManifest {
+    executionId: string;
+    target: string;
+    repositoryRevision: string;
+    timestamp: string;
+    adapters: AdapterRun[];
+    environment: {
+        sandbox: string;
+        network: 'denied' | 'allowed';
+        outputCapBytes: number;
+    };
+}
+/** Everything an adapter needs to describe how it should run. */
+export interface ScanTarget {
+    /** Absolute path to the audited project. */
+    path: string;
+    /** Scratch copy working directory; adapters run here, never in `path`. */
+    workdir: string;
+    revision: string;
+    executionId: string;
+}
+/** One process in a staged tool's pipeline (ORT `analyze`, CodeQL `create`). */
+export interface ScannerStage {
+    argv: string[];
+    /** Overrides the command timeout for this stage alone. */
+    timeoutMs?: number;
+}
+export interface ScannerCommand {
+    /** The command that produces the evidence. */
+    argv: string[];
+    /**
+     * Stages that must succeed before `argv` runs.
+     *
+     * Some tools are pipelines, not single processes: ORT's `evaluate` reads a
+     * result file that `analyze` writes, and CodeQL's `analyze` reads a database
+     * that `create` writes. Without this the adapter can only describe a command
+     * that will always fail on a fresh checkout.
+     */
+    prepare?: ScannerStage[];
+    /**
+     * Files the tool writes its parseable output to, relative to the scan
+     * workdir. The first that exists is read and handed to `parse` instead of
+     * stdout.
+     *
+     * Measured, not assumed: ORT's `evaluate` and CodeQL's `analyze` write JSON
+     * to a file and log to stdout, so an adapter that parses stdout gets progress
+     * lines where it expected violations.
+     */
+    artifacts?: string[];
+    network?: boolean;
+    /** Extra wall-time for slow tools (database builds). */
+    timeoutMs?: number;
+}
+export interface ScannerConfig {
+    [key: string]: unknown;
+}
+export interface AdapterProbe {
+    available: boolean;
+    version: string;
+    /** Why it is unavailable, when it is. */
+    reason?: string;
+    executable?: string;
+}
+/**
+ * The contract every scanner lives behind.
+ *
+ * `buildCommand` and `parse` are pure functions of their inputs — that is what
+ * makes a scanner testable without being installed.
+ */
+export interface ScannerAdapter {
+    readonly id: string;
+    readonly name: string;
+    /** True when a run may need network access (declared in the manifest). */
+    readonly needsNetwork?: boolean;
+    /**
+     * The `.usa/scanners.yaml` key that removes this adapter's network need, e.g.
+     * `scanners.semgrep.rules`. Named in the refusal message, because "needs
+     * network" is only actionable if the reader knows what to change.
+     */
+    readonly networkConfigKey?: string;
+    defaultConfig(): ScannerConfig;
+    /**
+     * `target` is optional so existing callers keep working, but the runner passes
+     * it: a scanner installed as the project's own devDependency lives in
+     * `node_modules/.bin`, not on PATH, and it is the better binary because it can
+     * resolve the project's dependencies.
+     */
+    probe(target?: ScanTarget): AdapterProbe;
+    buildCommand(target: ScanTarget, config: ScannerConfig): ScannerCommand;
+    parse(raw: string, context: ParseContext): Evidence[];
+    findings?(evidence: Evidence[]): ScannerFinding[];
+}
+export interface ParseContext {
+    adapterId: string;
+    adapterVersion: string;
+    target: ScanTarget;
+    config: ScannerConfig;
+}
+export interface ScanOptions {
+    target: string;
+    /** Adapter ids to run; default = all enabled in config. */
+    adapters?: string[];
+    config?: Record<string, ScannerConfig>;
+    /** Refuse to run anything that needs a build step (default true). */
+    allowBuildCommands?: boolean;
+    network?: boolean;
+    timeoutMs?: number;
+    now?: () => Date;
+}
+export interface ScanResult {
+    manifest: RunManifest;
+    evidence: Evidence[];
+    findings: ScannerFinding[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/scanner/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,yEAAyE;AACzE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,gBAAgB,GAChB,aAAa,CAAC;AAElB,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,cAAc,EAAE,aAAa,GAAG,iBAAiB,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,6DAA6D;IAC7D,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IACxB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,0DAA0D;IAC1D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,aAAa,IAAI,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACzC,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,cAAc,CAAC;IACxE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,QAAQ,EAAE,CAAC;IACtD,QAAQ,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B"}

package/dist/scanner/types.js

@@ -0,0 +1,11 @@
+/**
+ * Scanner subsystem types.
+ *
+ * These are the only types the adapter layer owns, and nothing in `src/engine/`
+ * imports them: a rule consumes scanner *artifacts* through the existing
+ * `oracle` check (ADR-0011) instead of importing evidence objects. That keeps
+ * the dependency direction one-way and keeps the rule engine free of any
+ * scanner-specific schema.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/scanner/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xenos1996/usa",
-  "version": "2.27.0",
+  "version": "2.28.1",
   "description": "Universal Software Auditor — an open-source, self-adapting audit framework for any project, any stack, any stage",
   "license": "MIT",
   "type": "module",
@@ -76,6 +76,7 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.4",
     "@vitest/coverage-v8": "^5.0.0",
+    "dependency-cruiser": "^18.7.0",
     "eslint": "^10.12.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.6.0",